Connect a Linux Wi-Fi Interface with wpa_supplicant

Network manager gone, headless box, or you need to see exactly what your wireless stack is doing: wpa_supplicant is the daemon underneath it. You will configure one WPA-Personal network, test the connection in the foreground, and then start it as a background daemon. This guide uses wpa_supplicant 2.10 from Ubuntu package wpasupplicant version 2:2.10-21ubuntu0.4. Allow about 15 minutes, plus time to find the correct wireless interface name.

The commands assume Linux, an available Wi-Fi device, a loaded driver, and permission to change network state. The installed manual names nl80211 as the preferred Linux driver. This guide changes the wireless connection and writes a file containing a network credential, so read the warning in step 2 before copying anything.

1. Find the interface and check the program

Run these read-only checks as your normal user:

$ command -v wpa_supplicant
/usr/sbin/wpa_supplicant
$ wpa_supplicant -v
wpa_supplicant v2.10
$ ip link show

Use the wireless interface name from ip link show, commonly something like wlan0 or wlp2s0. Replace wlan0 in every command below if yours differs. The interface must already exist and be enabled: the daemon exits if the device or its driver is not available.

2. Create a private configuration

Use a root-owned file when the machine has more than one user. The configuration can contain a plain-text passphrase, certificate passwords, or other authentication material. Do not put a real password in shell history, a ticket, or a public repository. Start with an editor:

$ sudoedit /etc/wpa_supplicant.conf

For a WPA-Personal network, enter this small configuration and replace both placeholder values:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
network={
    ssid="EXAMPLE_SSID"
    key_mgmt=WPA-PSK
    psk="EXAMPLE_WIFI_PASSPHRASE"
}

The ctrl_interface line creates a Unix control socket under /var/run/wpa_supplicant and permits the named group to use it. Only choose netdev if that group exists and its membership makes sense on your system; otherwise omit the GROUP=... part and keep control access restricted.

Protect the file after saving:

$ sudo chown root:root /etc/wpa_supplicant.conf
$ sudo chmod 600 /etc/wpa_supplicant.conf
$ sudo ls -l /etc/wpa_supplicant.conf
-rw------- 1 root root ... /etc/wpa_supplicant.conf

For a less exposed file, generate a hashed PSK instead. The installed wpa_passphrase command accepts the SSID and reads the passphrase from standard input:

$ printf '%s\n' 'EXAMPLE_WIFI_PASSPHRASE' | wpa_passphrase 'EXAMPLE_SSID'
network={
    ssid="EXAMPLE_SSID"
    #psk="EXAMPLE_WIFI_PASSPHRASE"
    psk=GENERATED_HEX_PSK
}

Copy the generated network block into the protected configuration without the commented plain-text psk line. A hashed PSK still grants network access if the file is stolen, so file permissions are still doing real work here.

3. Test in the foreground

Stop any existing network manager or supplicant instance that owns this interface before testing, but do not kill every wpa_supplicant process on a multi-interface host. Then run this as root so it can open the device and configure the connection:

$ sudo wpa_supplicant -Dnl80211 -iwlan0 -c/etc/wpa_supplicant.conf -d

Foreground mode keeps diagnostic output in the terminal. A successful run keeps waiting while it manages the interface; messages should show scanning, association and WPA key negotiation. Leave it running and open a second terminal for the next check. Press Ctrl-C to stop this test instance.

If it exits immediately, rerun with a second -d for more detail:

$ sudo wpa_supplicant -Dnl80211 -iwlan0 -c/etc/wpa_supplicant.conf -dd

Common traps are a misspelled interface, a device that is blocked or down, a wrong SSID or passphrase, and starting a second supplicant on the same interface. Keep the first error message that names the failure. Do not add -K while investigating: that option puts keys and passwords straight into debug output.

4. Verify association before requesting an address

In another terminal, inspect the link without changing it:

$ iw dev wlan0 link
Connected to AA:BB:CC:DD:EE:FF (on wlan0)
	SSID: EXAMPLE_SSID
	...
$ ip addr show dev wlan0

The exact signal and bitrate lines vary. What matters is a Connected to line with the expected SSID. wpa_supplicant handles wireless authentication and encryption; it does not replace the higher-level DHCP or address-management step. Hand off to the network manager or DHCP tooling already responsible for this host once association is confirmed.

5. Run it in the background

Once the foreground test works, stop it with Ctrl-C and start one background instance:

$ sudo wpa_supplicant -B -Dnl80211 -iwlan0 -c/etc/wpa_supplicant.conf
Successfully initialized wpa_supplicant

-B forks the daemon into the background. Its control socket is only useful if the configuration enabled ctrl_interface. If a distribution service or network manager normally owns the interface, configure that integration instead of launching a competing manual instance.

Configuration changes can be reloaded with a hangup signal, or through wpa_cli reconfigure when the control socket is available:

$ sudo kill -HUP "$(pgrep -xo wpa_supplicant)"
$ sudo wpa_cli -i wlan0 reconfigure

6. Add enterprise authentication only with its trust details

WPA-Enterprise is a different configuration, not a stronger version of the PSK block. The installed configuration manual documents, among others, EAP-TLS, PEAP and TTLS. An EAP-TLS network needs an identity, a CA certificate, a client certificate and its matching private key:

network={
    ssid="EXAMPLE_CORPORATE_SSID"
    key_mgmt=WPA-EAP
    eap=TLS
    identity="[email protected]"
    ca_cert="/etc/wpa_supplicant/certs/ca.pem"
    client_cert="/etc/wpa_supplicant/certs/user.pem"
    private_key="/etc/wpa_supplicant/certs/user.prv"
    private_key_passwd="EXAMPLE_KEY_PASSWORD"
}

Use absolute certificate paths, because the daemon may change its working directory in background mode. Confirm the certificate and private-key permissions separately. Do not disable CA validation or substitute a guessed certificate just to force an office network to connect.